1

I'm building an application where users can create content/articles. When each article/content is created, it will have a new wallet generated and the user will need to transfer some SOL to it when the content is created. Also other users can transfer sol to each of these "article/content" wallets when visiting.

I'm using Vue3 Solana wallet to do this and have new wallets generated for each content with Keypair.generate() and getting the logged in users wallet info from when they connect their wallets. So transferring Sol is all fine but the issue is that I need to store each of the newly generated wallet data (Public and Secret Key) into a database with the new content data.

In order to do this I ajax/axios post to my backend server where I pass the secret key of the newly generated wallet to save in the DB. This of course is terrible since the user can view source and see the secretkey for each article/content wallet on creation and will be able to take control of the content wallet (which I do not want). Also if any visitor was going to transfer SOL to these content wallets, It seems that I need to pass the secret key from the server to the client to do Keypair.fromSecretKey(secretKey).

This of course doesn't make any sense from a security stand point. So I guess my questions is how would I go about transferring the secret key back and forth from server to client without the client seeing this? I was hoping when doing a transaction with...

const transaction = new Transaction().add(
    SystemProgram.transfer({
      fromPubkey: publicKey.value,
      toPubkey: Keypair.generate().publicKey, <-- I wish this could just be a public key string
      lamports: 1,
    })
 );

That the toPubKey would just be a simple public key string but that does not work. So I have to somehow pass the secret back and forth in order to create the Keypair with Keypair.fromSecretKey(secretKey).

Any guidance or complete change of the way of thinking about this would be great. I'm still trying to get my head around all of this.

1 Answer 1

1

The best way to transfer SOL to a newly generated wallet for every new article/content would be to use a PDA. A PDA is a wallet that is owned by a custom program, hence to withdraw SOL from the PDA, you will have to use the custom program and instruct the program to withdraw the SOL from the PDA, which eliminates the need to store the private key of the wallet in your database. This custom program can easily be written using the Anchor framework and then deployed to the Solana Blockchain. Then sending and withdrawing SOL to and from the PDA respectively is just a matter of interacting with the custom program. You can read more on PDA's here

2
  • 1
    Thank you for this informative answer. I have an additional question... for each of the newly created articles, would I somehow generate a new PDA for each article? Or would I just have one PDA where all articles will pool in the transfers and then have the one PDA withdraw to multiple private wallets?
    – ZeroNine
    Commented Sep 20, 2022 at 18:07
  • 1
    This is completely up to you, any design you choose would work. I do not know the complete scope of your application but based on how your application has been described, I would personally prefer to use one PDA that article creators can transfer to and hence this PDA can withdraw to multiple private wallets. A scenario where I would prefer to use different PDAs per article would be when users who have read the article and are interested in making donations to the creator, the users would transfer to the PDA designated for the specific article and the creator can withdraw from the PDA. Commented Sep 20, 2022 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.